Black Duck Binary Analysis tool reports multiple vulnerabilities related to following files:
.azurefunctions/runtimes/win-x64/native/grpc_csharp_ext.x64.dll
.azurefunctions/runtimes/win-x86/native/grpc_csharp_ext.x86.dll
.azurefunctions/runtimes/linux-arm64/native/libgrpc_csharp_ext.arm64.so
.azurefunctions/runtimes/osx-x64/native/libgrpc_csharp_ext.x64.dylib
.azurefunctions/runtimes/linux-x64/native/libgrpc_csharp_ext.x64.so
Vulnerabilities include: CVE-2016-5180, CVE-2007-3152, CVE-2020-22217, CVE-2022-4904, CVE-2017-1000381, and many more.
I am using Microsoft.Azure.Functions.Worker.Extensions.DurableTask version 1.2.2.
My understanding is this component uses older version of grpc library.
It needs to be updated to use latest, as fixes for those vulnerabilities are available.